Skip to content

Improve GH Actions CI timings #1306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
l46kok wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Improve GH Actions CI timings #1306

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd604f7
Drop repo/bazel cache, prune disk cache entries
l46kok Oct 2, 2026
429d017
Address security findings
l46kok Oct 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 45 additions & 24 deletions .github/workflows/workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,25 +14,28 @@ concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
cancel-in-progress: true

permissions:
contents: read

jobs:
Bazel-Build-Java8:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
- run: echo "🐧 Job is running on a ${{ runner.os }} server!"
- run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
- run: echo "🔎 The name of your branch is ${GITHUB_REF} and your repository is ${GITHUB_REPOSITORY}."
- name: Check out repository code
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Mark job start
run: touch "$RUNNER_TEMP/job-start"
- name: Setup Bazel
uses: bazel-contrib/setup-bazel@0.18.0
uses: bazel-contrib/setup-bazel@083175551ceeceebc757ebee2127fde78840ca77 # 0.18.0
with:
# Avoid downloading Bazel every time.
bazelisk-cache: true
# Store build cache per workflow.
disk-cache: ${{ github.workflow }}-${{ github.job }}
# Share repository cache between workflows.
repository-cache: true
# Prevent PRs from polluting cache
cache-save: ${{ github.event_name != 'pull_request' }}
- name: Bazel Output Version
Expand All @@ -43,26 +46,35 @@ jobs:
run: .github/workflows/unwanted_deps.sh
- name: Cross-artifact Duplicate Classes Check
run: .github/workflows/cross_artifact_dependencies_check.sh
- run: echo "🍏 This job's status is ${{ job.status }}."
- name: Prune disk cache entries not used by this job
# Bazel bumps mtimes on use; drop stale entries so the saved cache doesn't grow unbounded.
if: github.event_name != 'pull_request'
run: |
du -sh ~/.cache/bazel-disk
find ~/.cache/bazel-disk -type f ! -newer "$RUNNER_TEMP/job-start" -delete
du -sh ~/.cache/bazel-disk
- run: echo "🍏 This job's status is ${JOB_STATUS}."
env:
JOB_STATUS: ${{ job.status }}

Bazel-Tests:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
- run: echo "🐧 Job is running on a ${{ runner.os }} server!"
- run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
- run: echo "🔎 The name of your branch is ${GITHUB_REF} and your repository is ${GITHUB_REPOSITORY}."
- name: Check out repository code
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Mark job start
run: touch "$RUNNER_TEMP/job-start"
- name: Setup Bazel
uses: bazel-contrib/setup-bazel@0.18.0
uses: bazel-contrib/setup-bazel@083175551ceeceebc757ebee2127fde78840ca77 # 0.18.0
with:
# Avoid downloading Bazel every time.
bazelisk-cache: true
# Store build cache per workflow.
disk-cache: ${{ github.workflow }}-${{ github.job }}
# Share repository cache between workflows.
repository-cache: true
# Prevent PRs from polluting cache
cache-save: ${{ github.event_name != 'pull_request' }}
- name: Bazel Output Version
Expand All @@ -71,7 +83,16 @@ jobs:
# Exclude codelab exercises as they are intentionally made to fail
# Exclude maven conformance tests. They are only executed when there's version change.
run: bazelisk test ... --deleted_packages=//codelab/src/test/codelab --test_output=errors --test_tag_filters=-conformance_maven --build_tag_filters=-conformance_maven
- run: echo "🍏 This job's status is ${{ job.status }}."
- name: Prune disk cache entries not used by this job
# Bazel bumps mtimes on use; drop stale entries so the saved cache doesn't grow unbounded.
if: github.event_name != 'pull_request'
run: |
du -sh ~/.cache/bazel-disk
find ~/.cache/bazel-disk -type f ! -newer "$RUNNER_TEMP/job-start" -delete
du -sh ~/.cache/bazel-disk
- run: echo "🍏 This job's status is ${JOB_STATUS}."
env:
JOB_STATUS: ${{ job.status }}

# -- Start of Maven Conformance Tests (Ran only when there's version changes) --
Maven-Conformance:
Expand All @@ -80,24 +101,24 @@ jobs:
steps:
- run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
- run: echo "🐧 Job is running on a ${{ runner.os }} server!"
- run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
- run: echo "🔎 The name of your branch is ${GITHUB_REF} and your repository is ${GITHUB_REPOSITORY}."
- name: Check out repository code
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
# Full history so changed-files doesn't need credentials to fetch more.
fetch-depth: 0
persist-credentials: false
- name: Get changed files
id: changed_file
uses: tj-actions/changed-files@v47
uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
with:
files: publish/cel_version.bzl
- name: Setup Bazel
if: steps.changed_file.outputs.any_changed == 'true'
uses: bazel-contrib/setup-bazel@0.18.0
uses: bazel-contrib/setup-bazel@083175551ceeceebc757ebee2127fde78840ca77 # 0.18.0
with:
# Avoid downloading Bazel every time.
bazelisk-cache: true
# Store build cache per workflow.
disk-cache: ${{ github.workflow }}-${{ github.job }}
# Share repository cache between workflows.
repository-cache: true
# Never write to the cache, strictly read-only
cache-save: false
- name: Verify Version Consistency
Expand Down
Loading